The vulnerability allows an attacker to supply NSEC3 records from a different zone that share an identical hash label, causing the DNS resolver to accept forged DNSSEC non‑existence proofs. This undermines DNSSEC trust and can lead to traffic being redirected to malicious sites or intercepted. The weakness is an authentication failure (CWE‑290).

Affected are the hickory‑dns library and hickory‑proto components prior to versions 0.26.2 and 0.26.0‑alpha.1 respectively. Any system using those releases is at risk.

The CVSS score of 8.7 rates the exploit as high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based DNS attack where an attacker injects rogue NSEC3 records into a zone that the victim’s resolver consults. Successful exploitation would allow DNSSEC trust to be subverted and requires no additional privileges beyond control of the attacker zone. Given the high score, the risk is significant if the software is deployed without the fix.